perf(fuse): FUSE-over-io_uring default on — kill switch AGENTFS_FUSE_URING=0

Codex A/B (n=5): equal-or-better on every phase — total 3.37x -> 2.92x,
status 0.93x -> 0.60x, read_search 1.41x -> 1.37x, clone -3%; the
synthetic-fixture write-phase regression that kept WS6 opt-in was a
toy-workload artifact. Safe as a default because INIT only advertises
FUSE_OVER_IO_URING after the ring-setup probe succeeds (requires root
sysctl fuse.enable_uring=1); everything else stays on the legacy
/dev/fuse channel. Gates green under the new default: noopen/flush
coherence, serialization, durability, metadata-mutation, 109 CLI tests.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: factory-ain3sh

cli/src/fuse.rs

@@ -730,23 +730,23 @@ impl Filesystem for AgentFSFuse {
             capabilities |= FUSE_NO_OPENDIR_SUPPORT;
         }
         let _ = config.add_capabilities(capabilities);
-        // Opt-in fuse-over-io_uring (AGENTFS_FUSE_URING=1): only advertise
-        // when the kernel offered it and ring setup works, since the kernel
-        // stalls requests after INIT until the ring queues register. The
-        // max_write clamp keeps per-entry ring payload buffers at 1 MiB
-        // (the kernel caps single WRITEs at max_pages = 256 pages anyway,
-        // so >1 MiB writes never materialize on Linux).
+        // FUSE-over-io_uring, default on (kill switch AGENTFS_FUSE_URING=0):
+        // only advertised when the kernel offered it and ring setup works,
+        // since the kernel stalls requests after INIT until the ring queues
+        // register; without the root sysctl fuse.enable_uring=1 the probe
+        // fails and the legacy /dev/fuse channel is used. The max_write
+        // clamp keeps per-entry ring payload buffers at 1 MiB (the kernel
+        // caps single WRITEs at max_pages = 256 pages anyway, so >1 MiB
+        // writes never materialize on Linux).
         if crate::fuser::uring::uring_enabled() {
             if crate::fuser::uring::probe_ring_setup()
                 && config.add_capabilities(FUSE_OVER_IO_URING).is_ok()
             {
                 let _ = config.set_max_write(crate::fuser::uring::URING_MAX_WRITE);
                 let _ = config.set_max_readahead(crate::fuser::uring::URING_MAX_WRITE);
-                tracing::info!("advertising FUSE_OVER_IO_URING (AGENTFS_FUSE_URING=1)");
+                tracing::info!("advertising FUSE_OVER_IO_URING");
             } else {
-                tracing::warn!(
-                    "AGENTFS_FUSE_URING=1 but kernel/ring support missing; using legacy channel"
-                );
+                tracing::debug!("fuse-over-io_uring unavailable; using legacy channel");
             }
         }
         if self.noopen {

cli/src/fuser/uring.rs

@@ -21,8 +21,9 @@
 //! reply synchronously, so each ring's submission queue is effectively
 //! single-threaded (guarded by a mutex that is never contended in practice).
 //!
-//! Opt-in via `AGENTFS_FUSE_URING=1`; depth per queue via
-//! `AGENTFS_FUSE_URING_DEPTH` (default 4).
+//! Default on when the kernel side is available (root sysctl
+//! `fuse.enable_uring=1`); kill switch `AGENTFS_FUSE_URING=0`; depth per
+//! queue via `AGENTFS_FUSE_URING_DEPTH` (default 4).
 
 #![cfg(target_os = "linux")]
 
@@ -134,10 +135,16 @@ const PAYLOAD_BUF_SIZE: usize = (URING_MAX_WRITE as usize) + 4096;
 
 // ─── configuration ──────────────────────────────────────────────────────────
 
+/// Default on: codex A/B showed the transport equal-or-better on every
+/// phase (total 3.37x -> 2.92x). Safe unconditionally because INIT only
+/// advertises FUSE_OVER_IO_URING after a ring-setup probe succeeds, which
+/// requires the root sysctl `fuse.enable_uring=1`; everything else falls
+/// back to the legacy /dev/fuse channel. `AGENTFS_FUSE_URING=0` is the
+/// kill switch.
 pub(crate) fn uring_enabled() -> bool {
-    matches!(
+    !matches!(
         std::env::var("AGENTFS_FUSE_URING").as_deref(),
-        Ok("1") | Ok("true") | Ok("on")
+        Ok("0") | Ok("false") | Ok("off")
     )
 }